1. Field of the Invention
This invention relates to the arts of computer user security and access control technologies, especially to those employed in UNIX and UNIX-like operating systems.
2. Description of the Related Art
The UNIX operating system, in all its varied forms and including similar operating systems, is a powerful tool upon which to base mission-critical applications. Its security, scalability, and robustness have led it to withstand the tests of time, and today, the majority of web servers are hosted on UNIX computers. Despite all of its strengths, however, methods exist to take advantage of its capabilities. Eliminating, or at least mitigating, the possibility of malicious actions is a major goal for UNIX system administrators.
One aspect of the UNIX system which may be open to manipulation is that of a user switching IDs (“SU'ing”) to a different user. In some cases, this may be done maliciously. In less than fifteen seconds at an unguarded root console, a malevolent user could enable SU functionality for his or her ID. Subsequently, that user could take on root authority on the machine, and either view or destroy sensitive data upon the system which is privileged to the root user, but not to the malevolent user's normal ID. Such “user switching” could also be done accidentally through a slip of the finger, or an authorized system administrator could inadvertently grant SU authority to a user.
Regardless of whether the switch is accomplished maliciously or accidentally, the effect is the same, in that the impacted user now has complete control and privileges over the entire system.
Two means exist for the administrator to uncover that such authority has been granted and/or used. The system administrator can manually review the characteristics of each individual user ID's. As large organizations often have hundreds or even thousands of users configured to use their systems, such periodic checks are not practical.
The second method which can be used is a visual inspection of the “SULOG” file, which contains a history of the “switch user” activities. Since this file can be extremely large, and is buried down within the system directory structure, inspection of the SULOG occurs seldom, if ever. Typically, an administrator is usually far too occupied with other responsibilities to check this file regularly.
It should be noted that SU authority can be granted in order to give a specific user the ability to switch to the root ID, or it can be granted to give users access to other ID's as well. Frequent examples of the latter include permitting certain users to switch their log-in to an “oracle” ID or a “backup” ID. Since such ID's often have expanded and critical functions and data available to them, it is also important to watch for such activity as this as well.
Therefore, a user who has been granted a low-level or restricted level of privileges or “permissions” may be his assigned initial login ID, but then he may obtain a higher level of privileges through doing a SU operation to the root ID. This is currently very difficult to track or detect given the default functions available in UNIX or other UNIX-like operating systems.
Therefore, there is a need in the art for a system and method to monitor unauthorized user switching or user substitutions on UNIX-based and UNIX-like systems so that appropriate corrective actions may be taken upon the detection of unauthorized user switching activities. This system preferably should be easily implement able by system administrators without significant changes to the operating system or user ID's that are already defined. Preferably, the system and method shall provide a remote notification function in order to notify a system administrator of a detected violation, such as an email notice.